Is birth date protected by HIPAA?

Editorial team Published on

Yes, a full date of birth is protected under HIPAA when it is held by a covered entity or business associate and linked to health or payment data.

How HIPAA Treats Birth Dates

  • Full Birth Date: Under the HIPAA Privacy Rule, a complete date of birth (month, day, and year) is one of the 18 specific personal identifiers. When connected to medical records, billing, or health conditions, it is classified as Protected Health Information (PHI).
  • De-Identification and Years: Under HIPAA’s Safe Harbor de-identification rules, the year of birth alone is generally not considered a unique identifier because it does not identify a specific person on its own.
  • Context Matters: A date of birth is only protected PHI if it belongs to a healthcare provider, health plan, or healthcare clearinghouse (or their business associates). General organizations outside of healthcare (like retail stores, employers, or utility companies) are not governed by HIPAA, though other privacy laws may apply.

Is date of birth covered under HIPAA?

Yes, a full date of birth is considered protected health information (PHI) under HIPAA when held by a covered entity.

Why Date of Birth is Protected

  • Identifier Status: Under HIPAA's Safe Harbor standards, all elements of dates (except the year) directly related to an individual—including birth date, admission date, and date of death—are official HIPAA Identifiers.
  • Connection to Health Data: A full date of birth combined with health records, treatment notes, or payment information qualifies as protected health information.
  • The Year Exception: Only the year of birth is allowed in de-identified datasets, because a full birth date is specific enough to help identify an individual.

Common Rules in Practice

  • Front Desk Requests: Healthcare staff can ask for your date of birth at check-in, as HIPAA allows basic, necessary administrative practices with reasonable privacy safeguards.
  • De-identification: To remove data from HIPAA coverage, organizations must strip away all 18 identifiers, including the specific month and day of birth.

Is birthday a HIPAA violation?

A full date of birth (month, day, and year) is legally classified as Protected Health Information (PHI) under HIPAA Privacy Rule guidelines, but simply asking for or handling a date of birth is not inherently a HIPAA violation.

When Date of Birth is Permitted

  • Identity Verification: Healthcare staff, such as receptionists or pharmacists, are fully authorized to ask for your name and date of birth to verify your identity and pull up the correct medical records.
  • Healthcare Operations: Sharing or recording a date of birth for treatment, payment, or standard operational workflows is allowed.
  • Safeguards: Front desk staff must use reasonable precautions (like lowering their voice or using desk partitions) so that other people do not overhear your oral PHI.

When Date of Birth Becomes a Violation

  • Improper Disclosure: Revealing a patient's full date of birth publicly or to unauthorized third parties without consent violates HIPAA.
  • Data De-identification: Under HIPAA's de-identification standards, full birth dates are one of the 18 restricted personal identifiers that must be scrubbed from data sets before they can be shared publicly or used for research. (Note: Under these specific rules, only the year must be omitted or aggregated if an individual is over 89, but the full day/month/year combination makes a standard record identifiable).

What is the new HIPAA rule in 2026?

The main new HIPAA requirement for 2026 is updating privacy notices under the HHS Model Notices of Privacy Practices to include stricter protections for substance use disorder (SUD) patient records.

Key 2026 Privacy Rule Updates

  • February 16, 2026 Deadline: Healthcare providers and health plans had to update their Notice of Privacy Practices (NPP).
  • Substance Use Records: Notices must now explain how substance use disorder records are protected under 42 CFR Part 2.
  • Legal Protections: Patient records generally cannot be used in civil or criminal legal cases without explicit consent or a court order.
  • Patient Rights: Patients gained clearer rights to restrict sharing, opt out of fundraising, and file complaints.

Proposed Security Rule Changes (Under Review)

Regulators are also pushing a major update to the HIPAA Security Rule that changes how organizations handle data safety:

  • No More "Addressable" Rules: Optional security steps are becoming mandatory.
  • Mandatory MFA: Multi-factor authentication is required across all systems.
  • Required Encryption: Patient data must be encrypted both in transit and at rest.

What are the three exceptions to HIPAA?

The three specific exceptions under the HIPAA Breach Notification Rule determine whether an unauthorized acquisition, access, or use of Protected Health Information (PHI) constitutes a reportable breach.

The Three Exceptions to a HIPAA Breach

  • Unintentional acquisition, access, or use of PHI: An employee or workforce member accesses PHI unintentionally, in good faith, and within the scope of their authority, without further impermissible disclosure.
  • Inadvertent disclosure between authorized persons: A person authorized to access PHI at a covered entity or business associate accidentally discloses that information to another authorized person within the same organization or arrangement, without further impermissible use.
  • Good faith belief that the recipient could not retain the information: An unauthorized disclosure where the covered entity or business associate has a good faith belief that the unauthorized person who received the PHI could not have reasonably retained it.

In-Depth: Clearing up the confusion around HIPAA

9 related questions found

Is date of birth considered PHI or pii?

A date of birth is always considered PII (Personally Identifiable Information) and can become PHI (Protected Health Information) depending on the context.

Personally Identifiable Information (PII)

  • Definition: Any data that can be used to identify, contact, or locate a single person.
  • Status: A date of birth on its own is universally classified as PII because it helps uniquely identify an individual, especially when combined with a name or address.

Protected Health Information (PHI)

  • Definition: Individually identifiable health data created, received, or transmitted by a healthcare provider, health plan, or clearinghouse. Under HIPAA guidelines, exact date elements (such as the specific day, month, and year of birth) are explicitly listed as one of the 18 personal identifiers.
  • Status: A date of birth becomes PHI only when it is linked to health or medical records (like a treatment date, diagnosis, or hospital visit) and handled by a covered entity. If it sits in a non-medical database (like a retail account or employment form), it is strictly PII.

You can read more about the rules governing healthcare records through the HIPAA Journal Definition of PHI or review how identifiers work via the Loyola University Chicago HIPAA Identifiers Guide.

What are the top 5 HIPAA violations?

The top 5 most common HIPAA violations involve failing to protect patient data through unauthorized access, weak safeguards, or delayed notifications.

1. Unauthorized Access to Patient Records

  • What it is: Staff members viewing Protected Health Information (PHI) out of curiosity or without a direct clinical need.
  • Example: Looking up the medical chart of a coworker, family member, or celebrity.

2. Theft or Loss of Unencrypted Devices

  • What it is: Laptops, phones, or USB drives containing electronic PHI (ePHI) going missing without proper encryption.
  • Example: Leaving a portable hard drive in an unlocked car where it gets stolen.

3. Lack of an Enterprise Risk Analysis

  • What it is: Failing to conduct regular, thorough security reviews of organizational systems and vulnerabilities.
  • Example: Not checking software or networks for security gaps that later lead to ransomware attacks.

4. Improper Disposal of Patient Records

  • What it is: Tossing physical paper files or un-wiped electronic media straight into standard trash or recycling bins.
  • Example: Putting printed daily appointment schedules into an open office dumpster.

5. Failure to Issue Timely Breach Notifications

  • What it is: Failing to notify affected individuals, the government, or the media within the mandatory 60-day window following a discovered data breach.
  • Example: Waiting six months to tell patients that their health records were exposed in a cyberattack.

Is your date of birth private information?

Yes, a date of birth is considered personal data and personally identifiable information (PII) because it relates to an identifiable living person.

Key Details About Date of Birth Data

  • Standard Personal Data: Under privacy laws like the GDPR, a birth date is standard personal data, not a "special category" (sensitive) piece of data like health or biometric records.
  • Identification Risk: While a birth date alone might not always identify someone instantly, when combined with a name or address, it uniquely points to an individual and can be used for identity theft or account access.
  • Legal Protection: Because it identifies a person, collecting, storing, and processing a date of birth requires a lawful basis and proper security measures under privacy regulations.

Is name and dob a HIPAA violation?

A name and date of birth (DOB) alone are personal identifiers, but they are only considered a HIPAA Violation if they are maintained or transmitted by a covered entity alongside health, treatment, or payment information.

When Name and DOB Are NOT a Violation

  • Identity Verification: Healthcare staff, pharmacies, and call centers are fully allowed to ask for your name and DOB to confirm your identity, locate your chart, or dispense medication.
  • Disconnected Data: If a list of names and birthdays exists in a database with zero health data (like a general marketing list not tied to a medical record), it is not protected health information (PHI) under HIPAA.

When Name and DOB ARE a Violation

  • Tied to Medical Data: A name and DOB are part of the 18 HIPAA Identifiers. If a hospital or clinic exposes them together with your diagnosis, treatment notes, or billing records to an unauthorized third party, it is a HIPAA breach.
  • Improper Disclosures: Broadcasting a patient's name and DOB in a public waiting room or emailing an unencrypted file containing patient names and medical details to outside parties violates the law.

What are the 10 most common HIPAA violations?

The 10 most common HIPAA violations involve mishandling protected health information (PHI) through employee error, weak security, or administrative oversight.

Top 10 Most Common Violations

  • Employee Snooping: Accessing patient files, family records, or coworker charts without a direct, professional need to know.
  • Lost or Stolen Devices: Leaving unencrypted laptops, smartphones, tablets, or USB drives where they can be stolen or accessed by outsiders.
  • Failure to Conduct Risk Analyses: Neglecting regular, organization-wide checkups to find and fix security gaps.
  • Improper Disposal of Records: Tossing paper charts in regular trash or failing to securely wipe old hard drives.
  • Weak Passwords and Access Controls: Using simple passwords or giving too many staff members broad, unmonitored access to electronic records (ePHI).
  • Unauthorized Texting or Emailing: Sending patient details over regular, unsecured text messages or standard email instead of encrypted platforms.
  • Missing Business Associate Agreements (BAAs): Failing to sign legal BAA contracts with outside vendors and cloud providers who handle patient data.
  • Delayed Breach Notifications: Missing the legal deadline to notify patients, the government, and the media within 60 days of discovering a data breach.
  • Inadequate Employee Training: Not providing regular, documented privacy and security awareness education for staff.
  • Denying or Delaying Patient Access: Taking longer than allowed (or refusing outright) to give patients copies of their own medical records.